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Fig. 2A 




Creating a simulated virtual computer 
circumstance, including virtual CPU, 
virtual OS. virtual peripheral devices (hard 
disk, floppy disk), and virtual memory 



Providing a plurality of objects(baits) to be 
infected by viruses 



Loading in the target object to be scanned 



Activating viruses attached on said target 
object to be scanned in said virtual computer 
circumstance 
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Fig. 2B 



Performing as many as possible operations on the 
baits in the virtual computer circumstance 



Reporting that the target object is infected, generating 
standard samples, and analyzing the type of the viruses 




S 1 1 3 Extracting all standard samples in said virtual 
circumstance 



Analyzing the standard samples by the virus 
analyzing machine, mainly determining 
whether the original functions of the standard 
baits(standard hosts) in the standard samples 
are integrated 




Original functions of the virus host have 
been destroyed, the virus can not be 
cleaned but deleted 
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Fig. 2C 



Learning by the virus learning machine from the 
standard samples all knowledge about the virus, 
including obtaining the key data or attributes required 
for cleaning the virus as possible as it can, until enough 



Searching or calculating by the 
virus-cleaning unit the key data or 
attributes modified by the virus in the 
host to be scanned(the host object), 
based on the knowledge learned by the 
virus-learning machine 



Succeed in calculation of 
the original values of the 
host's information 
modified by the virUS 



Data or attributes of the target object (the 
host object) which were modified by the 
virus are restored, such as the size of the 
file, the file header data, etc. 



Cleaning failed 



Cleaning succeeds 
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